HSE Audit and Risk Committee meeting minutes 4 October 2024

Members Present

Brendan Whelan (Chair), Michelle O’Sullivan, Pat Kirwan and John Moody

HSE Executive Attendance

Stephen Mulvany (Chief Financial Officer), Mairead Dolan (Asst Chief Financial Officer), Joseph Duggan (Chief Internal Auditor), Joe Ryan (ND Public Involvement, Culture and Risk Management/Chief Risk Officer), Niamh Drew (Deputy Corporate Secretary), Patricia Perry (Office of the Board)

Apologies

Éimear Fisher, Sharon Keogh and Trevor O’Callaghan (CEO Dublin Midlands Hospital Group)

Joined the Meeting

Francis Mollen (Acting ND Procurement)(Item 3.5), Elaine Kilroe (AND Enterprise Risk Management)(Item 4), David Langton (Asst ND Central Compliance Function)(Item 4.3), John Delamere (AND National Employee Relations)(Item 5.1), Brian O’Connell (Interim ND Capital & Estates)(Item 6);

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.  All performance/activity data used in this document refers to the latest information available at the time.

The Chairman held a private session to consider the agenda, papers and the approach to conducting the meeting.

1.1 Brief of Board Meeting – 27 September 2024

The Chair provided the Committee with an update of discussions held at the HSE Board Meeting of 27 September 2024.

2.1 Conflicts of Interest

No conflicts of interest were declared.

2.2 Minutes

The Committee approved the minutes of 06 September 2024, subject to an amendment being made.

2.3 Action Log and Follow Up Items

The Chair advised that he had reviewed the ARC Action Log with the Board Office and all actions were being progressed as per the Update Report.

2.4 Matters for Mention

1. Internal Audit Charter

Committee members had provided feedback to the Chief Internal Auditor, and it was noted that reference to the reassignment of the HSE’s Health Audit unit to the Chief Clinical Officer be included in the Committee’s Terms of Reference.

The Committee agreed to the adoption of the revised Internal Audit Charter.

3.1 YTD Expenditure and projection to Year-end

The CFO provided a briefing to the Committee on the cash position as of 30 September 2024 and outlook to year end. He advised that as of 31 August 2024, the HSE is marginally under the overall Department of Health (DoH) funded Financial Control Limit by €77.1m / 0.5%. Within that the Regional Health Areas (RHAs) are over their respective expenditure limits by €203.4m / 2.2% (July €166.1m / 1.8% over limit), which represents a €37.3m dis-improvement when compared to the July performance.

He advised that separate to this, the Department of Children, Equality, Disability, Integration & Youth funded Disability Services (DCEDIY) to end August are showing a deficit of €108.0m against budget, all of which is in the Regional Health Area (RHAs).

He advised that underspends within National Schemes / National Services and Corporate areas are offsetting the overspend against limits in the Regions. It was noted that this is not expected to continue to year end as these offsets are within demand led areas which are expected to be in line with their expenditure limit by year end, which is a temporary offset to 31 August 2024.

The CFO outlined that the 2-year financial agreement settlement announced in the Governments June 2024 Summer Economic Statement (between HSE, DOH & DPER) applies to DoH funded services only and is expressed in vote accounting terms (cash) rather than accrual accounting (income and expenditure – I&E). He presented to the Committee the Cash position for the HSE as best estimated in early October 24, and advised that DCEDIY funded disability services will be added to the analysis subsequently.

He advised that the agreement covers 2024 and 2025, and provides for additional cash in 2024 of €1,702m from DoH (via DPER) of which €1,500m is being provided on a recurring basis i.e. “into the base” for 2025. It was noted that at current cash utilisation rates, the estimate is that the HSE will likely exceed the cash available from the DoH by €122m and the cash available from DCEDIY by a further €151m, for a total cash over-run of c.€273m funded available.

The Committee noted that at the Board meeting in September, it was expected that REOs and other senior colleagues improve upon that position, which will require and will need additional focus, including the tightening of non-pay controls in regions. The Committee highlighted the need to see a real push, particularly in the 6 regions, to get monthly costs, particularly non-pay costs, down to a level of spend by December 2024 that is consistent with the average monthly cost that the 2024 spend limit supports.

3.2 Health Budget Oversight Group (HBOG)

The Committee noted minutes dated 13 February 2024 and 12 March 2024.

3.3 Tax Update

The Asst CFO introduced Colm Waters, Head of Tax to the meeting for consideration of this item. The Head of Tax provided an update to the Committee in relation to the Tax review for 2022, 2023 and other key issues.

He advised that the HSE carried out a focused high level Tax Self Review, in respect of the 2022 tax year during 2024, which was submitted to Revenue on 19 July 2024. The review was conducted based on two tax-heads, Employment Tax and VAT. The Committee noted that the outcome of the review resulted in an unprompted qualifying tax disclosure being made to the Revenue Commissioners and a payment of just over €1.8m in underpaid taxes and interest which is in the order of 0.01% of the 2022 overall taxes paid by the HSE and is 0.008% of overall HSE expenditure in that same year. It was noted that there has been no response to date from Revenue to the disclosure.

He advised that the 2023 Tax Review is currently in process, with Professional Services Withholding Tax (PSWT) and Relevant Contracts Tax (RCT) under review. The Committee noted that data for all the regions are currently being worked through and that no figures are available to be presented as yet.

As previously advised to the Committee, the Head of Tax provided an update in relation to the

Cooperative Compliance Framework (CCF). It was noted that Revenue had advised the HSE that it was not officially within the framework and had invited the HSE to join a pilot as the first public sector body within CCF which was being rolled out by Revenue to the public sector. The Committee noted that the HSE were officially informed by Revenue earlier this year that they were ending the pilot programme for the HSE, and noted that there has been very little overall difference in the relationship with Revenue.

3.4 Report on final account for completed commercial projects

The CFO provided an update to the Committee advising that a review was taken and several scenarios for developing and testing an interim reporting system to measure spend versus expected contract value and that at present the outcomes are neither reliable nor indicative. He advised that moving forward, through IFMS, the HSE & OGP contract references will be captured explicitly at the point of PO creation which will be linked to the item purchased. This will be rolled out to the HSE by July 2025 and he anticipates that the first comprehensive dataset for contract utilization reporting will be available by Q4 2025, and brought to the Committee on a quarterly basis.

3.5 Contract Approval Requests

Acting ND Procurement joined the meeting

The Acting ND Procurement presented to the Committee the following Contract Approval Request (CAR).

The Committee considered the detail of the proposed CAR and agreed to recommend to the Board for approval.

CFO and Acting ND Procurement left the meeting

AND Enterprise Risk Management and CCF joined the meeting

4.1 Draft Risk Appetite Statement

The ND Public Involvement, Culture and Risk Management (PICRM) and the AND Enterprise Risk Management (ERM) presented to the Committee the draft Risk Appetite Statement (RAS) and outlined the proposed alignment of the current RAS categories to the HSE’s Enterprise Risk Management Policy and Procedures 2023 (ERM Policy) risk impact categories.

The AND ERM advised the Committee that with the establishment of the Enterprise Risk Management Policy in 2023, there are certain differences in risk appetite categories to the risk impact categories set out in the ERM Policy used for reporting of risk, outlining that there are twelve risk appetite categories and nine risk impact categories in the ERM policy. The Committee noted that in order to align the documents and support reporting, that a minor update to map and align the RAS to the ERM Policy was proposed, and held a discussion on the changes presented. It was agreed that the Committee members would provide further feedback to the AND ERM and the draft RAS would be brought back to the November meeting for further review.

4.2 Chief Risk Officer General Updates

Enterprise Risk Management (ERM) Strategic Plan

The Chief Risk Officer (CRO) provided a verbal update to the Committee in relation to the Enterprise Risk Management (ERM) Strategic Plan, and advised that work has been ongoing with the Organisation Change team with regard to building capacity at regional level, with a proposal due to be submitted to the CEO. It was agreed that a paper would be brought to a future meeting of the Committee.

ERM Engagements – Voluntary Bodies

The Committee had queried at the September meeting if there was engagement with Voluntary Organisations as part of the Enterprise Risk Management (ERM) unit’s activities. The Committee welcomed the update noting that there continues to be engagement with voluntary organisations by the ERM unit which benefits collaborative approaches in managing and reporting on risks. The AND ERM advised that this is through training and development engagements being made available and with communication with AON, on behalf of the Voluntary Health and Risk Management Forum, where requirements or requests for bespoke engagements are discussed. The Committee welcomed and outlined the importance of these engagements.

ERM Risk Assessment – updated from feedback

The Risk Framework Assessment had been previously presented at the September meeting, where the Committee requested a more graphical format to the summary of the Framework, and the AND ERM advised that this was now reflected in the paper presented which set out the required components of a risk management framework and related activities that inform the ERM work programme.

The AND ERM advised that the assessment relates to the corporate level of the organisation only, and that further maturity assessments outside of this level will be developed in due course. The Committee welcomed the update and with progress made.

4.3 Half Year Protected Disclosure Report

The AND Central Compliance Function (CCF) presented to the Committee the Half Year Protected Disclosure Report which provided an update on Protected Disclosures activity for the period 01 January 2024 to 30 June 2024. He advised that 55 disclosure reports were received, which was up 15% compared with the same period in 2023 (48 reports). 16 of the disclosure reports were received from the Office of the Protected Disclosures Commissioner, which was an increase of 128% versus the previous year.

18 of the 55 disclosure reports (33%) which were received were assessed as valid Protected Disclosures.

He advised that if the current run rate of 15% increase of Protected Disclosure Reports received during the period compared with 2023 maintains up to year end, then the volume of reports received annually would have increased 87% since 2022, which is the year before the National Office of Protected Disclosures (NOPD) was established. He noted that while this is a welcomed development and points to increased trust in the process, the reality is that the volume of reports received is small in terms of the size of the organisation. As the NOPD further establishes itself with dedicated resources and increases their visibility in the organisation the volume of reports received will likely further increase.

He advised of the need to increase the exposure of the Protected Disclosures in the system and that initial scoping talks have occurred between the NOPD and HSeLanD with regard to wider training provision, the hosting of online training packages and communication on Protected Disclosure information for all staff.

He advised that as at 30 June 2024 there were 38 valid protected disclosures actively managed through the National Office of Protected Disclosures (NOPD). The Committee noted that 78% of the wrongdoings reported relate to either the improper use of funds (28%), or Health & Safety endangerment (50%). Given that Health & Safety issues accounted for 50% of the disclosures, the Committee requested that this data should be provided to the appropriate Board Committee and the Chief People Officer for information and action where appropriate.

The Committee noted that on the establishment of the NOPD, 117 legacy cases related to Protected Disclosures made between 2017 & 2022 were inherited, and welcomed that as at 30 June 2024, 13 of these cases remain open.

5.1 Internal Audit Monthly Report

The Chief Internal Auditor provided the Committee with an update in relation to the Internal Audit monthly report. He advised that a meeting was held with the CEO and CPO on 17 September 2024 and a Human Resources liaison has been provided to support the next stages of the Internal Audit restructure. The CEO has approved a proposal by the CCO on the Clinical Audit Model & Re-Configuration of Healthcare Audit, and was shared by the CCO with the REOs for comment, staff and Forsa will then be consulted and engaged with on the proposal. The reassignment of Healthcare Audit Unit to CCO has been agreed, and subsequent assignment of roles will be under the auspices of CCO. The CCO will attend the Committee meeting in November to outline the model that reconfigures Healthcare Audit.

The AND National Employee Relations joined the meeting to discuss the Internal Audit Industrial Relations issue and the Committee noted that audit work is not being produced by staff acting under the non-cooperation notice. The output for certain Internal Audit locations was noted and that 16 operational audits have not commenced due to the non-cooperation notice. The CIA advised that the issue has been raised again with National Employee Relations to outline a pathway for staff to undertake their full duties. The CIA outlined to the Committee the potential risks which the Committee considered.

The Committee outlined their concerns noting that the implications of this industrial action are serious, noting that it could result in insufficient audit coverage being completed in 2024 to enable the CIA to provide an overall audit opinion. This could lead to a qualified/limited opinion by the Committee regarding the adequacy of Internal Audit assurance for 2024, resulting in a compromised statement on the status of the system of internal controls in the Annual Financial Statement. The Committee stated that they remain without confidence that this matter will be resolved rapidly to avoid such implications.

The Committee asked that the CIA and AND National Employee Relations liaise in relation to a resolution deadline and revert to the Chair.

The CIA advised the Committee that interviews for a General Manager post in the Operations Unit were held in September 2024 and the position has been offered to the successful candidate.

The CIA provided an update in relation to the review of the implementation of the Scoliosis and Spina Bifida Action Plans 2022 & 2023. The Committee noted that the audit fieldwork is complete, and that a draft report was circulated the week commencing 30 September to relevant stakeholders as part of the formal clearance process. It was noted that stakeholders have 10 working days to respond to the review team, who will consider responses received as part of its process to finalise the report for submission to the CEO. The timeline for issuing the final report will be dependent on the responses received from stakeholders as part of the clearance process. It was agreed that a further update would be brought back to the Committee at a future meeting.

The CIA provided an update to the Committee in relation to the revised Global Internal Audit Standards & CIIA Code of Practice, and advised that the Reporting and Standards Unit in Internal Audit will report on the implementation of the revised Global IA Standards at the December meeting.

5.2 Process for HSE Internal Audit Plan 2025

The CIA outlined to the Committee the planning approach for the Internal Audit Plan 2025. He advised that the approach is based on research, analysis and consultation, with the Senior Leadership Team, the Committee and other stakeholders, who are invited to submit suggestions for audit topics linked to the Corporate Risk Register risk categories and Principal Risks to HSE Objectives.

The CIA set out the process steps and timelines. He advised that the draft plan will be shared with the stakeholders and the opportunity will be given to comment on the contents. The CIA will bring the proposed 2025 plan for consideration by the Committee at the December meeting.

Brian O’Connell, Interim ND Capital & Estates joined the meeting

6.1 Update on Capital Programmes and Major Capital Projects

Further to a previous request from the Committee, the Interim National Director, Capital & Estates presented an update on the provision of major Healthcare Infrastructure programmes, which are essential to support the objectives of Sláintecare and current and future service needs.

The Committee noted and discussed the paper presented which set out a high level summary of a number of programmes relating to Community Services, Acute Hospitals and other key Capital and Estate programmes.

The Committee welcomed that the Capital programmes were addressing many of the strategic priorities in the health and social care sectors, and reflected the deficiencies in the current infrastructure, arising from the lack of investment in the years following the financial crisis. It was noted that the programmes point to the achievement in the medium term of a significant upgrade in capacity and enhanced integration between the hospital and community sectors.

6.2 Building Contracts and Properties

The Interim ND Capital & Estates presented the following proposed contracts to the Committee, who considered with close scrutiny the detail, and agreed to recommend to the Board for approval.

Interim ND Capital & Estates left the meeting

There was no further business.

The Chair thanked the Committee and SLT members. The meeting ended at 11.30am.

Terms of Reference: Audit and Risk Committee